Assessing Brand Damage

Tim Erlin started a discussion about brand damage. However, the data he used was really about stock prices, not "brand", which is much harder to quanitify (and it's not easy to qauntify the affects of breach on stock price).

Recently, Javalin Research surveyed twelve hundred consumers randomly via phone during February on consumers' perceptions about breaches:

Although previous Javelin studies have proven that only a fraction of fraud in the U.S. is due to data breaches, 77% of consumers intend to stop shopping at merchants that suffer from data breaches. Retailers and merchants are viewed by 63% of consumers as the least secure when protecting consumer's data, compared with processors (16%), card networks like Visa or MasterCard (5%) and issuers (5%). When little is known about a data breach, half of all consumers automatically consider the merchants where they shop to be at fault. However, 85% will reward merchants who are perceived as security leaders with increased purchases.

The responses are suspect in my opinion. I find it hard to believe that 77% percent of TJX shoppers will stop shopping there. If TJX apologizes, explains how they have increased security and sends a discount coupon to affected consumers, the vast majority will return. However, not all will return.

The report also states that, absent any information about a breach, 49% of consumers will hold the merchant responsible. While this sounds like Visa promoting PCI to merchants, it also makes sense. Even if the payment processor looses my data, I didn't choose them. The merchant did.